jev-checker

A Python semantic checker that adds Jev powered review diagnostics alongside Ruff and Pyrefly. Install from PyPI:

python -m pip install jev-checker

Quick start

Jev loads a .env file from the current directory or a parent directory. Put one provider key in that file; shell environment variables take precedence:

# .env
TYPESAFE_API_KEY=...
# Or use OPENROUTER_API_KEY=... and pass --provider openrouter

# Run with TypeSafe
jev check .

# Run with OpenRouter
jev check . --provider openrouter

The jev-checker check executable is an alias for jev check.

Check committed changes against the merge base of a branch:

jev check . --diff origin/main

--diff reviews commits only. It does not include uncommitted working tree changes. The source excerpts selected for review are sent to the chosen provider after credential pattern redaction. Redaction cannot identify every secret; review your provider's data policy before using the checker on sensitive code.

Diagnostics

The default output resembles other checkers:

src/auth.py:42:5: error: a protected operation may lack authorization [JEV201]

1 error, 0 warnings, 0 infos

error fails the check; warnings and infos do not unless --warnings-as-errors is set. Configure rule levels in pyproject.toml:

[tool.jev]
provider = "typesafe"
select = ["JEV1", "JEV2", "JEV3", "JEV4", "JEV5", "JEV6", "JEV7"]

[tool.jev.levels]
JEV305 = "warning"
JEV601 = "error"
JEV704 = "info"
JEV503 = "off"

The checker keeps diagnostic level, Jev probability, confidence, and impact score as separate values. Use --output-format full for evidence details, --show to print every screening score and follow-up decision, or json for a machine readable report including screening scores. Supported formats are concise, full, json, and github. Exit codes are 0 for no errors, 1 for blocking diagnostics, and 2 when the requested analysis cannot be completed. --exit-zero affects only code 1. JSON reports also distinguish supported, dismissed, context-limited, and incomplete candidates while omitting raw source excerpts.

Built-in rules

• JEV1 correctness, JEV2 security, JEV3 reliability, JEV4 compatibility
• JEV5 test evidence, JEV6 performance, JEV7 observability

Security, correctness, reliability, and compatibility rules default to errors. Test, performance, and observability rules default to warnings. Use --select, --ignore, and --rule-level RULE=LEVEL to adjust the run.

Checker pipeline

Run each tool as a separate step so its result stays visible:

ruff check .
ruff format --check .
pyrefly check
jev check . --diff origin/main --output-format json > jev-report.json

Provide the diff base in the CI checkout. Keep provider credentials in the CI secret store and run authenticated reviews only in trusted jobs. jev check . --dry-run reports file and region counts without using credentials or the network. The default run allows up to 100 API attempts and 20 evidence follow-ups, with at most three concurrent requests. The local SQLite cache lasts 24 hours for pinned models; mutable aliases such as jev-latest bypass it. Use --no-cache to disable it for a run. The provider controls request pricing and rate limits.

Development

python -m pip install -e '.[dev]'
ruff check .
ruff format --check .
pyrefly check
pytest
pytest --cov=jev_review --cov-report=term-missing

The tests use simulated providers and do not make paid API calls. See docs/judgment-catalog.md for rule prompts and evidence criteria, and docs/implementation-plan.md for the implementation checklist and remaining release work.